Aggregator

A vulnerability identified as very critical has been detected in Xen XAPI. This affects the function xapi_pci_passthrough_configure of the file xapi_pci_passthrough.py of the component PCI Passthrough Configuration Handler. This manipulation of the argument pci_passthrough causes improper access controls. This vulnerability appears as CVE-2026-23562. The attack may be initiated remotely. There is no available exploit.

The Dutch National Police (Politie) says it has found "strong indications" that Dutch hackers have been involved in a February breach at the telecommunications provider Odido. [...]

A vulnerability categorized as very critical has been discovered in Linux Kernel. Affected by this issue is the function iptfs_consume_frags of the component xfrm. The manipulation results in buffer overflow. This vulnerability is reported as CVE-2026-53363. The attack can be launched remotely. No exploit exists.

A vulnerability was found in cservit affiliate-toolkit Plugin up to 3.7.0 on WordPress. It has been rated as problematic. Affected by this vulnerability is the function atkp_product of the component shortcode Handler. The manipulation of the argument attributes leads to cross site scripting. This vulnerability is documented as CVE-2026-15296. The attack can be initiated remotely. There is not any exploit available.

Progress Software has told ShareFile customers to shut down the Windows servers running their Storage Zone Controllers, confirming to The Hacker News that it is responding to a "credible external security threat." The company has temporarily disabled access to the affected accounts, a step it says it took "out of an abundance of caution" while it works with internal and external security

Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases. The compromised version, @injectivelabs/[email protected], came embedded with fake telemetry functionality that exfiltrated data from cryptocurrency wallets. The version was

Authorities launch Operation First Light 2026, attackers deploy Forg365 to hijack Microsoft accounts, and rival cyberspies breach Pakistani police networks.

Progress Software is emailing ShareFile customers who use Storage Zone Controllers to immediately shut down their servers after identifying what it describes as a "credible external security threat" targeting the on-premises secure file-sharing software. [...]

根据一项新研究，具有特定设计元素的人造环境可能会给大脑带来过度负担，导致视觉不适和压力。视觉不适是指人在看到某些图像或环境时所体验到的不适感，可能表现为眼睛疲劳、偏头痛、阅读困难，或者在他人毫无问题的情况下感到不堪重负。条纹图案、凌乱的内饰、高对比度颜色、闪烁的灯光，甚至是超市中密集的货架，都可能导致视觉不适，这有助于解释为何某些空间会让人感到不舒服。现代人造环境与视觉系统在演化过程中高效处理的自然场景存在显著差异。研究还发现，现代环境对敏感人群影响更大，对感官输入更敏感的人群（如偏头痛、自闭症、注意力缺陷多动障碍、阅读障碍或癫痫患者）可能受到的影响更强烈。

Telegram не будет обязан внедрять проверку сообщений, но лишится юридической защиты конфиденциальности в ЕС

A vulnerability was found in JetBrains YouTrack up to 2026.2.17393. It has been declared as problematic. Affected is an unknown function of the component Digest. Executing a manipulation of the argument Article can lead to cross site scripting. This vulnerability is registered as CVE-2026-61492. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in ST Engineering iDirect Evolution iQ-Series terminals, 3315-Series and 9-Series Terminals up to 4.5.2.1. It has been classified as problematic. This impacts the function reboot of the file /api/reboot of the component API endpoint. Performing a manipulation of the argument SameSite results in cross-site request forgery. This vulnerability is cataloged as CVE-2026-38057. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in getgrav Grav up to 1.0.2 and classified as critical. This affects the function HandlesMediaUploads::processUploadedFile of the file /api/v1/media of the component SVG File Handler. Such manipulation leads to unrestricted upload. This vulnerability is listed as CVE-2026-61456. The attack may be performed from remote. There is no available exploit.

A vulnerability has been found in Grafana up to 12.4.3/13.0.1 and classified as problematic. The impacted element is an unknown function of the component TableNG Panel. This manipulation of the argument field name causes cross site scripting. This vulnerability is tracked as CVE-2026-8595. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as critical, was found in MervinPraison PraisonAI up to 0.1.8. The affected element is an unknown function of the component Dependency Management. The manipulation results in improper authorization. This vulnerability is identified as CVE-2026-61441. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as problematic, has been found in Grafana up to 11.6.14/12.2.8/12.3.6/12.4.3/13.0.1. Impacted is an unknown function of the component OAuth Login Handler. The manipulation leads to allocation of resources. This vulnerability is referenced as CVE-2026-8609. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability classified as problematic was found in decolua 9router up to 0.5.1. This issue affects some unknown processing of the file open-sse/translator/concerns/image.js of the component Image Fetch Handler. Executing a manipulation can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-56676. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic has been found in getgrav Grav up to 2.0.0. This vulnerability affects the function ZipArchiver::extract of the component ZIP Extractor. Performing a manipulation results in denial of service. This vulnerability was named CVE-2026-61455. The attack may be initiated remotely. There is no available exploit.

A vulnerability described as critical has been identified in decolua 9router up to 0.4.79. This affects an unknown part of the file src/lib/auth/loginLimiter.js of the component Login Rate Limiter. Such manipulation of the argument X-Forwarded-For leads to missing authentication. This vulnerability is uniquely identified as CVE-2026-55501. The attack can be launched remotely. No exploit exists.